Data breach complaint against servicers gutted by judge

A trio of related servicers could face fewer legal consequences from a massive data breach after a federal judge dismissed nearly all of the claims against them in a class action lawsuit.

U.S. District Judge Darrin P. Gayles tossed 21 of 22 counts by customers against subsidiaries of Bayview Asset Management, leaving a claim for declaratory relief intact, according to a Dec. 15 filing. The complaint filed last March in Florida stems from an incident in late 2021 in which a hacker compromised the personally identifiable information of just over 4 million customers across the three companies. 

"Given that the data breach has already occurred and defendants continue to possess plaintiffs' PII, plaintiffs have sufficiently alleged a claim for declaratory relief," wrote Gayles about the one charge left in place.

It's unclear how much in damages plaintiffs are seeking. A spokesperson for Bayview Asset Management, parent of the three servicers, declined to comment Monday. Separate attorneys for the companies and plaintiffs didn't respond to requests for comment. 

Community Loan Servicing, Lakeview Loan Servicing and Pingora Loan Servicing disclosed the hack in early 2022, months after they discovered the breach. The attack by an undisclosed party occurred between Oct. 27, 2021 and Dec. 7, 2021 and compromised customer PII included loan information and Social Security numbers. Some plaintiffs claimed they were victims of identity theft after their PII was exposed on the dark web. 

Gayles last week dismissed class action accusations of negligence and violation of state consumer statutes for numerous reasons, including a lack of specificity for which company was responsible for certain security lapses. The judge also tossed a breach of contract claim because the plaintiffs' lenders, rather than the borrowers themselves, selected the servicers. 

"The fact that Lakeview and Pingora acquired Plaintiffs' PII does not elevate the relationship between a mortgagor and loan servicer to that of a fiduciary and a beneficiary," wrote Gayles. 

The servicing investor has said little about the attack, and disclosed in court filings it has a security operations center to protect its assets. The Coral Gables, Florida-based company owns over $620 billion in servicing and has purchased $163 billion in mortgages since its inception 30 years ago. 

The U.S. District Court for the Southern District of Florida Monday lifted a stay on proceedings, which was in place since the servicers filed their motion to dismiss last September. The case was previously on pace to go to trial in the first half of 2024. 

Other mortgage players which have suffered data breaches have been sued by consumers, and many of those complaints remain pending in federal courts. Bayview suffered one of the largest mortgage data breaches in the past few years, although others, like Flagstar Bank, have revealed hacks impacting over 1 million consumers. 

Mr. Cooper today is reeling from a two-day data breach in October which impacted over 14 million of its customers, according to a disclosure filed last week in a Maine public database. The megaservicer already faces at least six class action complaints over the incident and is spending millions of dollars more in the fourth quarter on vendor expenses related to the hack.